Ransomware has evolved into a triple extortion model where encryption is just the opening move, followed by data exfiltration and direct pressure on customers, regulators, and shareholders. The Change Healthcare attack — costing UnitedHealth Group $3.09 billion despite a $22M ransom payment — illustrates why cyber insurance is no longer a reliable safety net. Policies increasingly include ransomware sublimits, nation-state exclusions, and coverage disputes that drag on for years. The real defense is a mature incident response architecture: network segmentation, EDR tooling, immutable backups, and rehearsed response playbooks. Organizations that fared best against campaigns like Cl0p's MOVEit attack had mapped data flows and could respond within hours, not days.
